Security boffins harvest bumper crop of API keys from web

Researchers scanned 10 million websites using TruffleHog and discovered 1,748 valid API credentials exposed on public webpages. Affected organizations include a globally systemically important bank, drone firmware developers, and government agencies. Credentials for AWS, GitHub, Stripe, and OpenAI were among those found. Most exposures (84%) appeared in JavaScript files, often inside Webpack bundles. Credentials remained exposed for an average of 12 months before discovery. After researchers notified affected organizations, the number of exposed credentials dropped by half within two weeks. The study argues that dynamic analysis of live websites is essential, as most prior research focused only on code repositories.